diff --git a/mozilla/layout/reftests/bugs/reftest.list b/mozilla/layout/reftests/bugs/reftest.list
index 66508eb1460..52784484909 100644
--- a/mozilla/layout/reftests/bugs/reftest.list
+++ b/mozilla/layout/reftests/bugs/reftest.list
@@ -377,3 +377,4 @@ random-if(MOZ_WIDGET_TOOLKIT=="cocoa") == 379316-2.html 379316-2-ref.html # bug
 == 393671-2.html 393671-2-ref.html
 == 393671-3.html 393671-3-ref.html
 == 394111-1.html about:blank  # Really an assertion test rather than a rendering test
+== 394534-1.html 394534-1-ref.html
diff --git a/mozilla/parser/htmlparser/src/CNavDTD.cpp b/mozilla/parser/htmlparser/src/CNavDTD.cpp
index 8f6e1a00502..d004e7a66f5 100644
--- a/mozilla/parser/htmlparser/src/CNavDTD.cpp
+++ b/mozilla/parser/htmlparser/src/CNavDTD.cpp
@@ -1062,7 +1062,7 @@ PushMisplacedAttributes(nsIParserNode& aNode, nsDeque& aDeque)
   nsCParserNode& theAttrNode = static_cast<nsCParserNode &>(aNode);
 
   for (PRInt32 count = aNode.GetAttributeCount(); count > 0; --count) {
-    CToken* theAttrToken = theAttrNode.PopAttributeToken();
+    CToken* theAttrToken = theAttrNode.PopAttributeTokenFront();
     if (theAttrToken) {
       theAttrToken->SetNewlineCount(0);
       aDeque.Push(theAttrToken);
@@ -1742,14 +1742,19 @@ CNavDTD::HandleSavedTokens(PRInt32 anIndex)
         if (theToken) {
           theTag       = (eHTMLTags)theToken->GetTypeID();
           attrCount    = theToken->GetAttributeCount();
-          // Put back attributes, which once got popped out, into the tokenizer
+          // Put back attributes, which once got popped out, into the
+          // tokenizer.  Make sure we preserve their ordering, however!
+          // XXXbz would it be faster to get the tokens out with ObjectAt and
+          // the PopFront them all?
+          nsDeque temp;
           for (PRInt32 j = 0; j < attrCount; ++j) {
             CToken* theAttrToken = (CToken*)mMisplacedContent.PopFront();
             if (theAttrToken) {
-              mTokenizer->PushTokenFront(theAttrToken);
+              temp.Push(theAttrToken);
             }
             theBadTokenCount--;
           }
+          mTokenizer->PrependTokens(temp);
 
           if (eToken_end == theToken->GetTokenType()) {
             // Ref: Bug 25202
diff --git a/mozilla/parser/htmlparser/src/nsParserNode.cpp b/mozilla/parser/htmlparser/src/nsParserNode.cpp
index 493f561cff3..6646032c4f0 100644
--- a/mozilla/parser/htmlparser/src/nsParserNode.cpp
+++ b/mozilla/parser/htmlparser/src/nsParserNode.cpp
@@ -264,6 +264,11 @@ nsCParserNode::PopAttributeToken() {
   return 0;
 }
 
+CToken* 
+nsCParserNode::PopAttributeTokenFront() {
+  return 0;
+}
+
 /** Retrieve a string containing the tag and its attributes in "source" form
  * @update	rickg 06June2000
  * @return  void
@@ -353,6 +358,12 @@ nsCParserStartNode::PopAttributeToken()
   return static_cast<CToken*>(mAttributes.Pop());
 }
 
+CToken* 
+nsCParserStartNode::PopAttributeTokenFront() 
+{
+  return static_cast<CToken*>(mAttributes.PopFront());
+}
+
 void nsCParserStartNode::GetSource(nsString& aString) const
 {
   aString.Assign(PRUnichar('<'));
diff --git a/mozilla/parser/htmlparser/src/nsParserNode.h b/mozilla/parser/htmlparser/src/nsParserNode.h
index 0353cd3d215..34214bfd3b4 100644
--- a/mozilla/parser/htmlparser/src/nsParserNode.h
+++ b/mozilla/parser/htmlparser/src/nsParserNode.h
@@ -239,6 +239,9 @@ class nsCParserNode :  public nsIParserNode {
      */
     virtual CToken* PopAttributeToken();
 
+    /** Like PopAttributeToken, but pops off the front of the attribute list */
+    virtual CToken* PopAttributeTokenFront();
+
     /** Retrieve a string containing the tag and its attributes in "source" form
      * @update	rickg 06June2000
      * @return  void
@@ -314,6 +317,7 @@ public:
     virtual const    nsAString& GetKeyAt(PRUint32 anIndex) const;
     virtual const    nsAString& GetValueAt(PRUint32 anIndex) const;
     virtual CToken*  PopAttributeToken();
+    virtual CToken*  PopAttributeTokenFront();
     virtual void     GetSource(nsString& aString) const;
     virtual nsresult ReleaseAll();
 protected: